Skip to Content

Researchers Find Security Cracks in Google Glass

Starting with Google Glass, wearable technology could usher in a new era of security weaknesses, researchers say.
July 17, 2013

Internet-connected devices are ripe for hacking—and it seems that wearable gadgets like Google’s forthcoming head-mounted computer, Glass, are no exception.

Marc Rogers, principal security researcher at mobile security startup Lookout, said this week that the company’s researchers examined Google Glass in May, looking for weaknesses that hackers could exploit. They soon focused on the fact that Google uses QR codes to let users configure Glass, and that whenever a Glass user takes a photo, the device searches for readable information (including QR codes).

The researchers learned that it was possible to use custom QR codes to get Glass to do things without the wearer’s knowledge, like quietly connect to a hacker-controlled wireless network. This could occur when the wearer takes a picture of a QR code on a poster or T-shirt, for example, believing the code to be benign.

Lookout detailed the weakness in a post on its blog on Wednesday, and released a short video explaining the problem.

The Lookout researchers found that by creating a QR code that caused Glass to connect to their own wireless access point, they could control traffic coming on and off the device, Rogers said. In theory, this would allow a hacker to spy on a user’s uploaded photos, or direct him to malware on the Web.

Similarly, the researchers found that a QR code could force Glass to connect via Bluetooth to a device of the researcher’s choosing, without the Glass wearer’s knowledge.

Though Lookout quickly reported the weakness to Google, and the search company fixed the problem within two weeks, it points to a larger problem: as everything from glasses to watches to thermostats become Internet-connected, those gadgets become vulnerable to malware and other security and privacy issues.

“I think bad guys will target wherever they feel the opportunity is,” said Rogers, noting that every popular computing platform has become a target for malware.

Rogers sees Google as a good test case for how such connected devices can be rolled out: before selling Glass next year to the general public, the company offered it to a limited group of testers, who are developing apps and finding bugs—a move the company says is intended to resolve problems in advance of general sales.

Because of this, Rogers expects that when Glass is released, Google will have not only fixed most of the “low-hanging” vulnerabilities, but will also be able to quickly fix any other issues that emerge.

Keep Reading

Most Popular

A Roomba recorded a woman on the toilet. How did screenshots end up on Facebook?

Robot vacuum companies say your images are safe, but a sprawling global supply chain for data from our devices creates risk.

A startup says it’s begun releasing particles into the atmosphere, in an effort to tweak the climate

Make Sunsets is already attempting to earn revenue for geoengineering, a move likely to provoke widespread criticism.

10 Breakthrough Technologies 2023

Every year, we pick the 10 technologies that matter the most right now. We look for advances that will have a big impact on our lives and break down why they matter.

These exclusive satellite images show that Saudi Arabia’s sci-fi megacity is well underway

Weirdly, any recent work on The Line doesn’t show up on Google Maps. But we got the images anyway.

Stay connected

Illustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at customer-service@technologyreview.com with a list of newsletters you’d like to receive.